TW202036350A - An integrated circuit, method and computer program - Google Patents

Abstract

An integrated circuit is disclosed. The integrated circuit comprises: a processing region configured to run one instruction from a plurality of instructions; a first temperature measuring region configured to measure a first temperature within the integrated circuit in response to the processing region running the one instruction; the processing region being configured to compare the measured first temperature with a predefined temperature at the first temperature measuring region when the processing region runs the one instruction and to trigger an event when the measured first temperature exceeds the predefined temperature by a threshold value.

Description

An integrated circuit, method and computer program

This description is about an integrated circuit, method, and computer program.

The "background technology" described here broadly presents the content of this description. Therefore, it is neither expressly nor implicitly acknowledged that the work of the current inventor mentioned in the background art and the content that may not be regarded as the prior art at the time of application is the prior art of this description.

Physical attacks on semiconductor chips (such as smart card chips for credit and charge cards or mobile subscriber identification cards for mobile phones) are known. In this type of attack, the hacker may try to obtain keys or other secrets stored securely in the semiconductor chip circuit. This type of attack requires physical access to the chip.

In this type of attack, optical detection may occur where the wafer becomes thinner from the backside down to a remaining thickness of 10 μm (or less), and laser detection is used. In other cases, in order to perform electrical or electron beam detection on metal interconnects, the semiconductor must be completely removed from the back of the selected area. Other physical attack mechanisms require thinning of the chip for high-resolution X-ray tomography or light emission studies.

To reduce the possibility of a successful physical attack is to try and protect the backside of the semiconductor chip. However, it is still very rare to successfully find a protection mechanism that is not too expensive or complicated to introduce into the integrated circuit manufacturing process.

Therefore, a method is needed to reduce the possibility of a successful physical attack on the semiconductor wafer, and this method does not only protect the backside of the semiconductor wafer. This is the goal to be achieved by this description.

According to a certain aspect, an integrated circuit is provided, including: a processing area for executing one of a plurality of instructions; a first temperature measuring area configured to measure the processing area in the integrated circuit to execute the instruction When the processing area executes the instruction, the processing area is configured to compare the first measured temperature of the first temperature measurement area with a predetermined temperature, wherein when the first measured temperature exceeds the When the predetermined temperature reaches a threshold, the processing area triggers an event.

The foregoing paragraphs have been introduced in a broad manner and are not intended to limit the scope of the following invention patent applications. The mentioned embodiments and further advantages can be best understood with reference to the following detailed description and related drawings.

Reference drawings, where the same reference numbers indicate the same or corresponding elements in each drawing.

According to the illustrated embodiment, FIG. 1 shows an integrated circuit 100. The integrated circuit 100 is made of semiconductor materials such as silicon (Si) or gallium arsenide (GaAs). In the illustrated embodiment, the integrated circuit 100 will consist of a die or a PIN type credit or charge card containing non-contact technology. Therefore, the integrated circuit 100 can comply with the EMV standard, or other standards or according to the standards of ISO/IEC 7816 and ISO/IEC 14443.

Although the integrated circuit 100 includes several individual areas, and each area performs various functions that meet these standards, for the convenience of explanation, FIG. 1 shows three areas. Of course, more or less than three regions can be expected.

The integrated circuit 100 includes a processing area 110 to exchange and process data. Generally, data is exchanged in Application Protocol Data Units (APDUs) and processed according to instructions. For example, if an instruction is sent to the processing area 110, the processing area 110 will process it appropriately and exchange data with other areas in the integrated circuit 100. An instruction refers to a single operation in the processing area 110 taken from an instruction set containing multiple instructions, and is completed by a technician.

The command in the die and PIN technology can be, for example, a command. This command may include a password command for generating an application program, a command for an application processing area, a command for external verification, or a similar command. The commands known to these technicians are defined by various standards such as ISO/IEC 7816-3.

It should be understood that although the above-defined commands are used in die and PIN technology, some commands such as external verification commands are used in other die card applications (such as GSM SIM compliant with ISO/IEC 7816-4 standards). Card technology). Therefore, this specification is not limited to die and PIN technology, and can be equally applied to any suitable technology.

During command processing, the processing area 110 can process or exchange sensitive data. In other words, the processing area 110 can process or exchange data, but if the data is retrieved by a malicious third party, the security of the integrated circuit 100 may be damaged. The sensitive data can be, for example, a key used to generate a password, or personal information related to the user of the integrated circuit 100. This sensitive data can be stored in the secure part of the storage area 105 in an unencrypted form. For example, the key used to generate the password is stored in the secure part of the storage area 105 in an unencrypted form.

In operation, in order to approve the transaction, the processing area 110 can receive an application password generation instruction through the communication circuit 115 as an instruction from a card reader (not shown) communicating with the communication circuit 115. In addition to instructions, the processing area 110 will receive other data units, such as the number of transactions and other information related to the approval of transactions from the card reader. The processing area 110 will retrieve the key from the secure part of the storage area 105, and will use the key to encrypt other data units to generate a password. The password is then sent to the communication area 115, and then sent to the card reader.

If a malicious third party performs a physical attack on the integrated circuit 100, when the key is retrieved from the storage area 105, the third party can access the key from the bus 130 connecting the processing area 110 and the storage area 105. In other words, the third party can transmit the application password generation instruction from the card reader. In response, the unencrypted key will be retrieved from the secure part of the storage area 105 and intercepted when the exposed internet content is detected by a third party using electrons or electron beams. Indeed, if a physical attack can directly access the secure part of the storage area 105, the key can be retrieved directly from the secure part of the storage area 105. This may damage the safety of the integrated circuit 100.

When the integrated circuit 100 is manufactured, the storage area 105, the processing area 110 and the communication area 115 on the semiconductor die are included, and the heat dissipation material is arranged on it. During the operation of the integrated circuit 100, in order to ensure that no part of the integrated circuit 100 will overheat, fail or fail to operate, the distribution of heat dissipation materials and the heat dissipation characteristics are controlled.

The heat dissipation material can be placed anywhere on the semiconductor die. This includes the backside of the semiconductor die. As mentioned above, in order to make physical contact with the integrated circuit 100, at least a part of the back surface of the semiconductor die is removed. This means that at least part of the heat dissipation material is removed. This changes the characteristics of the heat dissipation material in the integrated circuit 100.

In particular, after the heat dissipation material is removed from an area, the in-situ temperature of the semiconductor die in this area is significantly increased compared to the area where the heat dissipation material is located. This is because the heat dissipation material has better heat dissipation characteristics than heat dissipation to the surrounding environment.

Therefore, in the embodiment of this description, one or more temperature sensors are installed in the integrated circuit 100 to measure the temperature of at least one area during the operation of the integrated circuit 100. In the example, when the temperature of the area exceeds a threshold, an event is triggered. In other words, if the temperature of the area exceeds the threshold, it can be assumed that the integrated circuit 100 has suffered a physical intrusion. Therefore, the event may include deleting or destroying the data in the storage area 105 or a part of the storage area 105 (such as the secure storage part), destroying the processing area 110, or publishing false data from the secure part to confuse sensitive data. In other words, this incident prevents hackers from obtaining sensitive information.

As mentioned above, the storage area 105 and the processing area 110 are areas of the integrated circuit 100 on the semiconductor die where the hacker wants to get physical contact. Specifically, not limited to the embodiment, the secure part of the storage area 105 and the area where the processing area 110 communicates with the secure part are areas that physical hackers particularly want to contact.

Therefore, a first temperature sensor 120 is fabricated in the safe area of the storage area 105, and a second temperature sensor 125 is fabricated in the processing area 110. In other words, in the embodiment, the first temperature sensor 120 and the second temperature sensor 125 are located on multiple areas of the integrated circuit 100, and these areas may be exposed or changed during a physical attack. Of course, this description is not so limited, and the sensor can be located anywhere on the integrated circuit 100, such as an area that is less targeted as an attack, to provide a background temperature reading. These temperature sensors are manufactured using known techniques and may include reusing transistors already manufactured in these areas. For the sake of brevity, since the manufacturing method of the temperature sensor on the semiconductor die and the integrated circuit 100 is known, it will not be explained in detail below.

In a physical intrusion event, since the heat dissipation material on the semiconductor die is removed, the temperature measured by the first temperature sensor 120 and the second temperature sensor 125 will exceed the temperature of the area when the heat dissipation material is not removed . In particular, when the heat dissipation material is present, the processing area 110 executes a given command and gives an ambient temperature, the temperature measured by the first temperature sensor 120 and/or the second temperature sensor 125 will be very good Be defined. In other words, when the heat dissipation material is present, when a specific command is executed in the processing area 110, the temperature rise of the safe area of the processing area 110 and/or the storage area 105 will be well defined.

However, during the physical attack, in areas where the heat dissipation material has been removed, damaged or destroyed in any way, for a given command, the first temperature sensor 120 and/or the second temperature sensor 125 measures The temperature will be very different than expected.

Therefore, in the embodiment of this description, for a given command, if the temperature measured by the first temperature sensor 120 and/or the second temperature sensor 125 is higher than the expected temperature by a predetermined value, it can be confirmed that there is Physical attack.

FIG. 2 shows an integrated circuit 100 according to an embodiment. In the integrated circuit 100 of FIG. 2, several components referred to in FIG. 1 are shown. These parts have common reference numbers, and readers can refer to the discussion in Figure 1. In addition, there is a third temperature sensor 210 in the communication circuit 115 and a fourth temperature sensor 205 in the non-secure part of the storage area 105.

Generally, during a physical attack, the heat dissipation material around the communication circuit 115 remains unaffected. This means that the third temperature sensor 210 can measure the ambient temperature or the background temperature of the integrated circuit 100. Of course, this description is not so limited. In order to measure the ambient temperature of the integrated circuit 100, the third temperature sensor 210 can be placed in any position in the integrated circuit 100 that is less likely to be physically attacked.

As mentioned above, a fourth temperature sensor 205 is provided in the non-secure part of the storage area 105. Similar to the communication circuit 115, the non-secure part of the storage area 105 is less likely to be invaded, and the heat dissipation material around the non-secure part of the storage area 105 usually remains intact. Therefore, the fourth temperature sensor 205 can also be used to measure the ambient temperature of the integrated circuit 100.

It should be noted that providing one or more ambient temperature sensors is optional.

Figure 3 shows a flowchart 300 describing one of the illustrated embodiments. The flowchart 300 uses software stored in the storage area 105 and is executed in the integrated circuit 100 of the embodiment.

The flowchart 300 starts at step 305. When the processing area 110 executes an instruction, the procedure proceeds to step 310. An example command is to use a card reader to communicate with the communication circuit 115 to receive the password command of the application program. Since the command is executed by the processing area 110, the processing area 110 investigates the first temperature sensor 120 and receives the temperature measured by the first temperature sensor 120. This is step 315. When the processing area 110 investigates the second temperature sensor 125 and receives the temperature measured by the second temperature sensor 125, the process proceeds to step 320. It is of course expected that the processing area 110 may investigate the third temperature sensor 205 and/or the fourth temperature sensor 210 to supplement or replace the first temperature sensor 120 and the second temperature sensor 125. In other words, it is expected that during a physical attack, a first temperature reading will come from an area that is more likely to be damaged, and a second temperature reading will come from another area that is more likely or less likely to be damaged.

The processing area 110 then compares the difference between the first and second temperatures. This is step 325. When a check is established to determine whether the difference between the first and second temperature exceeds a threshold temperature, the process proceeds to step 330. This is described in more detail in FIG. 4. In the event that the gap exceeds the threshold temperature, that is, a physical attack is detected, the "Yes" path is selected to proceed to step 335, and as explained above, an event such as deleting at least the safe part of the storage area 105 will be executed. The program then proceeds to step 340, and the flowchart ends.

Returning to step 330, if the temperature difference does not exceed the threshold temperature, select the “No” path to proceed to the end of the process, that is, step 340.

Flowchart 330 mentions that when a specific command is executed and the temperature difference exceeds a threshold temperature, a physical attack is detected. When the command is executed, one of the measured temperatures may be the ambient temperature or may be a specific area in the integrated circuit 100 or an area affected by a physical attack.

In some situations, when a specific command is executed, a physical attack may be detected because the difference between three or more temperature measurements exceeds a threshold.

It should be noted that this description is not limited to multiple temperature measurements. For example, when the processing area 110 executes a command, when the temperature measurement of the area that is more likely to be damaged by a physical attack exceeds a specific temperature by a predetermined value, it may indicate that a physical attack is detected. In other words, when the processing area 110 executes a specific command and the absolute temperature measurement exceeds a specific temperature, it may indicate that a physical attack is detected.

Figure 4 shows a table. In one embodiment, the table is stored in the storage area 105. The form can be stored in a secure part of the storage area 105 to ensure the integrity of the form. The table may be associated with the command to be executed by the processing area 110 at the desired temperature at the first temperature sensor 120, the second temperature sensor 125, the third temperature sensor 205, and the fourth temperature sensor 210 Any data structure. In other words, when the processing area 110 executes a specific command and the heat dissipation material is complete, the table stores the expected temperature of each temperature sensor. When an environment temperature is given, the above-mentioned expected temperature is the absolute temperature of each temperature sensor.

As in the above embodiment, the difference between the two measured temperatures is used to determine whether a physical attack occurs. By considering the temperature difference, it is particularly effective for mitigating the influence of ambient temperature. In other words, when absolute temperature is taken into consideration, in a high-temperature environment, even if no physical attack occurs, the absolute temperature may still exceed the threshold. However, when the difference between the two measured temperatures is used to detect physical attacks, the impact of the ambient temperature can be reduced. This reduces the possibility of errors in detecting physical attacks.

In the example table of FIG. 4, the command executed by the program area 110 is an application password command, and the heat dissipation material is complete. The first temperature measured by the first temperature sensor 120 is 55 degrees Celsius, and the second temperature sensor 120 The second temperature measured by the sensor 125 is 85 degrees Celsius, the third temperature measured by the third temperature sensor 205 is 45 degrees Celsius, and the fourth temperature measured by the fourth temperature sensor 210 is 40 degrees Celsius. . This temperature distribution display command is executed by the processing area 110. In other words, when the application password command is executed, the processing area 110 will receive the password from the secure part of the storage area 105. Since this is a complicated command, the processing area 110 is required to perform intensive operations, which means that the second temperature (the temperature associated with the processing area 110) will be high. In addition, when the safe part of the storage area 105 is operating, the first temperature (the temperature associated with the storage area 105) will rise.

Since the non-secure parts of the communication circuit 115 and the storage area 105 are not intensively operated, the third measurement temperature and the fourth measurement temperature are approximately the ambient temperature.

In the example table of FIG. 4, the command executed by the processing area 110 is a command to confirm the card reader, and the heat dissipation material is complete. The first temperature measured by the first temperature sensor 120 is 40 degrees Celsius, and the second temperature The second temperature measured by the sensor 125 is 55 degrees Celsius, the third temperature measured by the third temperature sensor is 40 degrees Celsius, and the fourth temperature measured by the fourth temperature sensor 210 is 70 degrees Celsius. . Once again, this temperature distribution shows that this command is executed by the processing area 110. Specifically, the command to confirm the card reader does not need to access the secure part of the storage area 105. Therefore, the first temperature measured by the first temperature sensor 120 is approximately the ambient temperature. Since the instructions are not complicated, the processing area 110 does not require intensive operations. This means that the second temperature (the temperature of the processing area 110) is very low compared to the temperature during complex operations. Furthermore, since the non-secure part of the storage area 105 does not need to process instructions to confirm the card reader, the third temperature associated with the non-secure part of the storage area 105 is low. Finally, since the communication circuit 115 must communicate with the card reader to process instructions, the temperature of the communication circuit 115 measured by the fourth temperature sensor 210 rises.

Accordingly, when a specific instruction is executed on the processing area 110 and the integrated circuit 100 has a complete heat dissipation material, the table of FIG. 4 includes the predetermined temperature associated with each temperature sensor. The difference between any two of the storage temperatures is the predefined temperature difference.

Therefore, returning to step 330 in FIG. 3, for the integrated circuit 100 in which the processing area 110 is running a specific command, determine the temperature difference between the two measured temperatures. For the same instruction, compare the predetermined temperature difference between the two measured temperatures stored in the table in Figure 4. For example, if the threshold between the two measured temperature differences is higher than 10% of the predetermined temperature difference is reached, the process proceeds to step 335. Or, if the measured temperature is less than or equal to the threshold, the process proceeds to step 340, as explained in FIG. 3. Of course, although the foregoing takes the threshold value of the temperature difference being higher than 10% of the predetermined temperature difference as an example, this description is not so limited. The gap can be a different percentage or an absolute value.

As explained in the above described embodiment, when the integrated circuit 100 executes a command, the temperature of each part is the characteristic of the integrated circuit 100. This means that although the above has described whether to remove the heat dissipation material from the semiconductor die, this description is not so limited. For example, in some situations, it is necessary to ensure that instructions are only executed on specific (ie, legal) integrated circuits. In order to prevent individuals from executing instructions on other integrated circuits, a system similar to the one described above can be used. In other words, when a command is executed, the temperature of one or more parts of the integrated circuit can be measured and compared with a predetermined temperature when a legal integrated circuit executes the same command, and then when the measured temperature is higher than the threshold Trigger an event. This is useful if the manufacturer wants the software to run only on specific and certified integrated circuits. Therefore, the above techniques can be used to identify when to run this software on an uncertified integrated circuit, because the temperature when the software executes a command on an uncertified integrated circuit is different from that of a certified integrated circuit. The temperature at the time of command.

Obviously, according to the above instructions, various modifications and changes in this description are possible. Therefore, it can be understood that within the scope of the patent application, this description can be implemented in a manner different from that described here.

As far as the embodiments of this description have been implemented, data processing equipment controlled by software can understand that a non-transitory machine-readable medium (non-transitory machine-readable medium), such as a CD or a disk, is installed with software. , Semiconductor memory or others, can be used to represent the embodiments of this description.

It should be understood that the above description has referred to different functional elements, circuits, and/or processors for clarity. Obviously, without departing from the embodiment, any functional layout in different functional elements, circuits and/or processors may be used.

The described embodiments can be implemented in any suitable form, including hardware, software, firmware, or any combination of the foregoing. The described embodiments can be selectively implemented at least partially in computer software running on one or more data processors and/or digital signal processors. The elements and components of any embodiment can be implemented in any suitable physical, functional and logical manner. In fact, the functionality can be implemented as a single unit, multiple units, or as part of other functional units. In this way, the embodiments of this description can be implemented in a single unit, or physically and functionally distributed among different units, circuits, and/or processors.

Although this description has described many embodiments, the descriptions here are not intended to be limited to a specific form. In addition, although the features of this specification have been described in conjunction with specific embodiments, those skilled in the art may understand that the various features of the embodiments can be combined with any suitable implementation technology.

The embodiments of this description can be defined according to the following numbering clauses:

1. An integrated circuit, including: A processing area, configured to execute one of a plurality of instructions; A first temperature measurement area configured to measure a first temperature when the processing area in the integrated circuit executes the instruction, wherein: When the processing area executes an instruction, the processing area is configured to compare the first measured temperature of the first temperature measurement area with a predetermined temperature, wherein when the first measured temperature exceeds the predetermined temperature by a threshold, the The processing area triggers an event.

2. The integrated circuit as described in clause 1, further including: A second temperature measurement area configured to measure the second temperature when the processing area in the integrated circuit executes the instruction, wherein when the difference between the first measurement temperature and the second measurement temperature exceeds a predetermined When a predefined temperature difference reaches a preset value, the processing area triggers an event.

3. The integrated circuit as described in clause 1 or 2, wherein the event is the detection of a physical attack on one of the integrated circuits.

4. The integrated circuit as described in clause 3, further including: A storage area including a secure area and a non-secure area, wherein when the physical attack event is detected, the processing area is configured to delete data in the secure area.

5. A method for detecting a physical attack in an integrated circuit, which includes the following steps: Execute one of a plurality of instructions; and Measuring a first temperature when the integrated circuit executes the instruction; and When the instruction is executed, compare the first temperature with a predetermined temperature of the first temperature measurement area; and When the first measured temperature exceeds a threshold of the predetermined temperature, an event is triggered.

6. A method for detecting a physical attack in an integrated circuit as described in clause 5, further including: Measuring a second temperature when the integrated circuit executes the instruction; and When the difference between the first measured temperature and the second measured temperature exceeds a predetermined temperature difference by a predetermined value, the event is triggered.

7. The method for detecting a physical attack on an integrated circuit as described in clause 5 or 6, wherein the event is to detect a physical attack on the integrated circuit.

8. The method for detecting a physical attack in an integrated circuit as described in clause 7, wherein when the physical attack event is detected, the method is configured to delete data in a secure area of the integrated circuit.

9. A computer program for instructions that can be read by a computer. When the program is uploaded to a computer, configure the computer to perform the method described in any of clauses 5-8.

100: Integrated circuit 105: storage area 110: Processing area 115: communication area 120: The first temperature sensor 125: second temperature sensor 205: The third temperature sensor 210: The fourth temperature sensor 300: flow chart 305,310,315,320,325,330,335,340: steps

By referring to the following detailed description and considering the accompanying drawings, you will have a more complete understanding of this description and its additional advantages, among which: Figures 1 and 2 respectively describe an integrated circuit of this specification and its embodiments; Figure 3 depicts a flow chart of an embodiment of this description; FIG. 4 depicts a table of the storage temperature in the illustrated embodiment of FIG. 3. FIG.

100: Integrated circuit

105: storage area

110: Processing area

115: communication area

120: The first temperature sensor

125: second temperature sensor

Claims (9)

An integrated circuit including: A processing area configured to execute one of a plurality of instructions; and A first temperature measurement area configured to measure a first temperature when the processing area in the integrated circuit executes the instruction, wherein: When the processing area executes an instruction, the processing area is configured to compare the first measured temperature of the first temperature measurement area with a predetermined temperature, wherein when the first measured temperature exceeds the predetermined temperature by a threshold, This processing area triggers an event. The integrated circuit as described in claim 1, further including: A second temperature measurement area configured to measure the second temperature when the processing area in the integrated circuit executes the instruction, wherein when the difference between the first measurement temperature and the second measurement temperature exceeds a predetermined When the temperature difference reaches a preset value, the processing area triggers an event. The integrated circuit according to claim 1 or 2, wherein the event is to detect a physical attack on the integrated circuit. The integrated circuit described in claim 3 further includes: A storage area including a secure area and a non-secure area, where when the physical attack event is detected, the processing area is configured to delete data in the secure area. A method for detecting a physical attack in an integrated circuit, which includes the following steps: Execute one of a plurality of instructions; Measuring a first temperature when the integrated circuit executes the instruction; When the instruction is executed, compare the first temperature with a predetermined temperature of the first temperature measurement area; and When the first measured temperature exceeds a threshold of the predetermined temperature, an event is triggered. The method for detecting a physical attack in an integrated circuit as described in claim 5 further includes: Measuring a second temperature when the integrated circuit executes the instruction; and When the difference between the first measured temperature and the second measured temperature exceeds a predetermined temperature difference by a predetermined value, the event is triggered. The method for detecting a physical attack on an integrated circuit as described in claim 5 or 6, wherein the event is detecting a physical attack on the integrated circuit. The method for detecting a physical attack in an integrated circuit as described in claim 7, wherein when the physical attack event is detected, the method is configured to delete data of a safe area in the integrated circuit. A computer program for instructions that can be read by a computer. When the program is uploaded to a computer, the computer is configured to execute the method described in any one of Claims 5 to 8.

Images